Apache OpenOffice CVE-2026-90631

Exploitation requires a victim to open an attacker-crafted Apache OpenOffice document (versions through 4.1.16) that contains external links; the vulnerability is that these links load automatically without the normal user prompt, and the resulting outbound request can carry environment-variable contents to an attacker-controlled endpoint. Limiting factors: the attack is client-side and depends on user interaction (opening the malicious document), impact is limited to disclosure of environment variables accessible to the application process rather than code execution, and it is fixed by upgrading to 4.1.17 (no other mitigation is stated by the vendor). Authentication requirements are not confirmed from available data because no CVSS vector was supplied.

No CVSS vector, EPSS score, or KEV entry is provided in the input, so quantitative exploitation signals are absent and the vuln.today decision label is 'awaiting_data' - this should be treated as incomplete triage rather than a confirmed high-urgency item. The vendor rates it 'important'. The flaw is a missing-authorization issue (CWE-862-class) in document link handling: a crafted document causes external links to load without the usual user prompt, with possible exfiltration of environment-variable contents. Real-world risk is bounded by the fact that exploitation requires a victim to open an attacker-supplied document (user interaction), and the impact is information disclosure (env vars) rather than code execution - there is no indication of integrity or availability impact. No public exploit is identified at time of analysis, and there is no EPSS or KEV data to indicate widespread or targeted exploitation. Authentication requirements cannot be confirmed because no CVSS vector was supplied; the attack targets a user opening a document, so it is a client-side social-engineering vector, not a server-side remote-unauthenticated one. Net: a legitimate client-side info-leak worth patching via the 4.1.17 upgrade, but on the available signals it is not demonstrably an active-exploitation emergency.

An attacker crafts an OpenOffice document containing external links and delivers it to a victim via email or download. When the victim opens the document, the external links are fetched automatically without the normal confirmation prompt, and the request can carry the contents of environment variables to an attacker-controlled server. No public exploit code is identified at time of analysis.